Skip to content

Suspicious User Logs Scroll Query.

POST
/api/data/namespaces/{namespace}/app_security/suspicious_user_logs/scroll
curl --request POST \
--url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/app_security/suspicious_user_logs/scroll \
--header 'Authorization: <Authorization>' \
--header 'Content-Type: application/json' \
--data '{ "namespace": "example", "scroll_id": "example" }'

Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more than 500 messages. To scroll through more than 500 or all messages, one can use the SuspiciousUserLogsScrollRequest. Use the scroll_id returned in the SuspiciousUserLogsResponse to fetch the next batch of logs and one can continue this process till the scroll_id returned is "" which indicates no more logs to scroll.

Examples of this operation.

namespace
required
string

Namespace fetch the next batch of suspicious user logs scoped by namespace.

Media typeapplication/json
Suspicious User Logs Scroll Request

Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more than 500 messages. To scroll through more than 500 or all messages, one can use the SuspiciousUserLogsScrollRequest. Use the scroll_id returned in the SuspiciousUserLogsResponse to fetch the next batch of logs and one can continue this process till the scroll_id returned is "" which indicates no more logs to scroll.

object
namespace
namespace

Fetch the next batch of suspicious user logs scoped by namespace.

string
>= 6 characters <= 1024 characters
scroll_id
scroll id

Long Base-64 encoded string which can be used to retrieve next batch of security events.

string
<= 1024 characters
Examplegenerated
{
"namespace": "example",
"scroll_id": "example"
}

A successful response.

Media typeapplication/json
Suspicious User Logs Response

Response message for Suspicious User Logs Request.

object
aggs
aggregations

Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.

object
logs
events

List of log messages that matched the query. Contains no more than 500 messages.

Array<string>
scroll_id
scroll id

Long Base-64 encoded string which can be used to retrieve the next batch of suspicous user logs using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF). Note: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the scroll request should be sent within 2 minutes upon receiving the SuspiciousUserLogsResponse.

string
<= 1024 characters
total_hits
total hits

Total number of logs that matched the query.

string format: uint64
<= 1024 characters
last_sort_values
object
last_doc_id
last_doc_id

This is a unique UUID generated by elastic search.

string
<= 1024 characters
last_timestamp
last timestamp

Configuration parameter for last timestamp

number format: double
Examplegenerated
{
"aggs": {},
"logs": [
"example"
],
"scroll_id": "example",
"total_hits": "example",
"last_sort_values": {
"last_doc_id": "example",
"last_timestamp": 1
}
}

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example